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During approximately the past 3 or 4 years, personnel at MSC 
have had the responsibility for implementing the ACE-S/C checkout 
system into the operational world of Apcllo CSM/LM Checkout. Along 
with this responsibility has come the advantages of being directly 
involved with resolving daily operational problems, developing 
engineering design changes, and generally assessing the ACE-S/C 
systems ability to meet the CSM/LM checkout and test requirements. 
As the equipment operators (Contractor and NASA) became more 
familiar with the system operation, and as the test personnel 
became more aware of the actual S/C test requirements, more demands 
were and are being placed on what the ACE-S/C checkout system must 
accomplish. In certain uses it became necessary to make signi- 
ficant hardware modifications to satisfy these requirements. In 
other cases, a matter of operational procedures was sufficient, 
or as is now the usual case, software design changes were imple- 
mented to meet the requirements. 


It has become apparent to us at MSC that the ACE system as now 
implemented cannot much longer continue to satisfy new requirements 
or satisfy expanding tasks of new S/C programs with the needs for 
test and evaluation becoming more extensive and sophisticated. With 
this sort of knowledge, it became further obvious that yesterday 
was the time to start the next generation system concept and design 
development. To that end, several individuals at MSC have become 
active over the past ten months. 


It is the intent of this paper to introduce some of our past 
thinking and to present what we feel are some of the salient features 
of a next generation S/C checkout system. To accomplish this, the 
paper will begin with a basic system designation of the present 
ACE-S/C system, identify recognized ACE capabilities, outline some 
of the more pertinent requirements for a new system, present one of 
our evaluation tools, define a new system organization, and then 
discuss in some detail our present wofcf Hiatus. 
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ACCEPTANCE CHECKOUT EQUIPMENT (ACE-S/C) - TODAY 

The ACE-S/C checkout station being utilized today at NR-Downey, 
GAEC-Bethpage, KSC and at MSC are basically configured as they were 
when installation started in July 1964. In the first part of this 
section we will define this configuration, giving a brief functional 
description and system operating specifications. The latter part of 
this section will concentrate on system assessment which will briefly 
describe system loading, operational capabilities and constraints. 

SYSTEM DESCRIPTION 


The ACE-S/C checkout system is organized basically into three 
functional areas. These are: 

a. Computer facility 

b. Control Room 

c. Spacecraft Interface equipmei ts 

These areas are linked together through another area called 
the Signal Distribution Room which, for the purpose of this paper, 
will be considered a passive patch element. 

CONFIGURATION 


Computer Room - 

Looking at the computer facility we have the digital processors 
consisting of two CDC l60 G Computers and peripherals, the PCM data 
acquisition hardware which is two Radiation 540 decoms, a computer 
room control console, digital transmission and receiving terminals, 
real time and count down time code translators, and a number of digital, 
analog, and event type recorders (magnetic tape and paper). 

The two computers are for all intents functionally dedicated 
processors . 

The one computer, referred to as uplink, accomplishes the man 
interface whereby manual requests for S/C stimuli are recognized. 

This causes pre-determined digital command words to be formatted 
and transmitted to the S/C system or GSE via the digital transmission 
link. Other functions performed by the uplink computer include: 

a. Control call in of alternate test sequence loads. 

b. Recording on digital tape special error messages derived 
from the Guidance and Navigation System. 

c. Control over playback of special recorded data. 

d. Performing S/C to L/V Checkout computer communications. 
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The second computer, referred to as downlink, accomplishes 
the function of processing the S/C and GSE response data which 
is provided by the PCM decoms. The purpose of the computer 
processing is: 

a. Engineering conversion and formatting for display to test 
personnel. 

b. Formatting of compressed raw data for digital tape 
recording. 

c. Buffering out display data to CRT’s and other special 
direct driven elements. 

d. Control Input of data from decom. 

e. Supplying uplink computer with telemetry information to 
permit automatic sequencing. 

f. Special AGC processing. 

g. Other engineering functions such as ”OR’d” events and 
barometric pressure monitoring. 

The PCM data acquisition hardware performs the standard 
functions of PCM synchronization, word formatting, and providing 
display routing information. In addition, the basic hardware has 
been modified to permit: 

a. Tolerance testing of parameters against fixed limits. 

b. Tolerance testing of parameters against a floating 
limit (dynamic tolerance). 

c. Direct access to computer memory for storing PCM data 
in specific memory locations. 

The computer room control console provides necessary display 
information and controls to permit integration of the computer room 
activities with those activities being performed in the control room. 
Basically it contains: 

a. CRT display for A/N data# 

b. Status lights for computer room equipment performance. 

c. Control devices for computer communications by the 
operator. 

d. Controls over analog mag tape recorders. 

e. Clock controls. 

The digital transmission terminals provide for communicating 
with remote digital equipments. Its functions are to take parallel 
computer words, serializing the data and redundantly transmitting 
over hardlines. The terminals also receive serialized data from 
the remote digital equipments, checks for transmission errors, puts 
into parallel format for input to a computer. 
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The real time and count down time code translators are 
utilized to format standard IRIG timing signals into a computer 
compatible format and directly interfaces with both computers. 

Recording of S/C test data is partially accomplished by the 
various recorders in the computer room. This includes the 
computer digital tapes used for recording of compressed raw 
S/C and GSE measurements, the analog mag tapes for recording 
raw PCM data, and paper strip charts recorders for analog and 
event type responses. 

Control Room - 

The control room is that area in the ACE-S/C system which 
provides the primary control over S/C testing. Configuration of 
the control room is a series of low-boy and high-boy consoles 
which are physically and functionally grouped into elements which 
normally relate to a S/C system. These consoles are then manned 
by appropriate systems test personnel. The task of integrating the 
activities at the system consoles is performed by S/C test conductors 
at their own console grouping. The system consoles are so designed 
to provide the necessary real time test information to the operator 
as well as providing the operators with the necessary controls for 
stimuli execution or S/C and GSE systems control. The basic console 
elements are: 

a. Displays 

b. Starts (computer input devices) 

c. Recorders 

The displays are composed of two types. Alphanumeric displays, 
which are computer (downlink) driven with real time processed 
engineering information, and decom or computer driven event lights 
and analog meter modules. 

Three types of starts, C, R, and K, are used by operators to 
input control requests to the uplink computer which are then trans- 
lated to stimuli signals to S/C and GSE systems. The C-STARTS pro- 
vide for input of 10 BCD characters or plus/minus signs into the 
computer. C-STARTS are used normally to control analog voltage 
generations, operator message inputs, or can be used as a redundant 
back-up to the R-STARTS. The R-STARTS are four bit binary type 
input operator messages which are normally used for applying 
discrete voltage to systems or to control relays. The K-START 
is used exclusively for communicating with the S/C onboard computers. 
K-START data inputs, via paper tape or manual keyboard, consist of 
decimal characters or binary coded function words. 
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Recorders are mounted In the operator consoles and are 
driven either directly by the decom or can be driven by computer 
generated data. The recorders are standard 8 channel analog 
recorders and 100 channel event recorders under manual control. 
Time code recordings accompany the signal recordings on 
appropriate tracks. 

Spacecraft Interface - 

The S/C interface equipments are those digital units which 
provide the direct interface between the S/C or GSE, and the 
ACE-S/C computer room facility, or central control station. The 
interface equipment consists of the Digital Test Command System 
(DTCS) which is the stimuli source or uplink side, and the Digital 
Test Monitor System (DTMS) which provides the system outputs or 
response via the PCM or downlink data. 

The DTCS receives coded serial messages from the uplink 
computer terminals, checks for transmission errors, decodes the 
message as to type, i.e., analog, relay, or digital computer 
word, routes and applies signal to the proper stimuli point. 

The DTMS performs two basic functions. It monitors S/C system 
and GSE outputs and encodes these into PCM, and secondly it 
functions to interleave or time multiplex up to four PCM trains 
into a single PCM stream. The interleaved signal is then 
transmitted over hardlines to the ACE-S/C decom system. 

SYSTEM CAPABILITY 


In performing the job of S/C checkout there exists certain 
functional tasks which the ACE-S/C system must be capable of 
satisfying. For instance, the ACE~S/C system must be capable 
of supplying the full stimuli spectrum required for checkout 
and at the same time handle the total PCM data stream. One of 
the biggest tasks is that of processing information and prepar- 
ing it for presentation to the user \ i.e., the test operator, so 
that he can make proper decisions about test continuance and 
control. The system is basically a two computer control system 
working together through a shared memory concept. The shared 
memory forms a type of data bank supplied with information by the 
decoms and buffered I/O devices directly accessing the shared 
memory. The processors are supported by real time and countdown 
clocks which can be pre-set to signal the processors at the proper 
time or interval. Through a series of interrupt levels, control of 
the processing tasks is accomplished by the processor executive. 
This part of the discussion will present system capability in 
terms of information flow rates and types of information outputs. 
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Downlink - Taking the S/C as the starting point, information 
is generated by three basic data sources. One source is the flight 
PCM which transfers information at 51.2/1.6 kbs and is the normal 
source for inflight information. A second source is 51.2 kbs data 
stream gathered from S/C GSE with the third source being a 51.2 kbs 
data stream which is generated by an external PCM generator connected 
to additional system measurement points required for checkout. The 
three data sources are then interleaved with a spare 51.2 link to 
form one continuous PCM data stream of 204 kbs. Each data stream 
contains the capacity for 128 time slots of 8 bit words, repetitively 
transmitted at 50 times per second. This then creates the basic 
real time process update rate of 20 milliseconds for the collective 
data stream of 512 available time slots. The PCM decoms perform 
the standard function of bit synch, prime frame synch and ID or 
subframe synchronization. The decom is a stored program processor 
which has the ability to directly route the 8-bit data words to 
analog meters or to event lights. Through the direct memory access 
mod, mentioned earlier, the decom sorts measurements by sample rate - 
50, 10, 1 - and stores each of these in a unique address in computer 
memory (higher sample rates are treated as separate 50 sps measure- 
ments). Additionally, each measurement can be checked against 
fixed high/low limits, and against a floating limit which uses a 
fixed tolerance. Data stored in computer memory is, therefore, 
uniquely located and flagged as to result of limit checks. 

The downlink computer now has the task of measurement handling, 
engineering conversions, formatting, and ground processing. One 
of its real time tasks is that of reviewing all measurements for a 
floating limit flag and processing them for recording on a digital 
tape (CDT - Compressed Data Tape). For 50 sps measurements or 
higher sample rates, the computer must cover these measurements 
every 20 milliseconds. The 10 sps measurements must be completely 
reviewed by every fifth frame while the 1 sps measurements must be 
checked only once every 50 frames. This task is of utmost importance 
in that the CDT has been identified as the prime source of data for 
post test processing and analysis. A second real time function of 
the downlink processor is that of getting information displayed to 
the operators in a meaningful manner. This involves engineering 
limit conversion, raw data translation with cal data, formatting, 
and alpha numeric scope updating. Except for selected measurements, 
scope updating is performed once per second. Special type display 
processing includes the performance of ’’logical ORing” of selected 
system outputs and displaying these on event type displays under 
computer control. Included within the special type of real time 
processing for display is the computer process of S/C computer (s) 
words with results being placed on the G/N CRT display and/or event 
type displays and recorders. A third basic real time process require 
mont is that of critical response detection. This is principally a 
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task of continuous monitoring of the PCM stream to detect the 
unspec if table time of occurrence type signal. This signal may 
be an out-of- limit occurrence, a response to some stimulus input, 
or an unanticipated change in state of a steady state line which 
creates a critical or catastrophic response. Computer response 
to the occurrences range from signaling the uplink computer to 
proceed to the next test sequence such as in automatic test 
sequences, to displaying the occurrence on a CRT or event light 
and recording on a magnetic tape file. 

The uplink computer becomes the next logical step around 
the S/C - checkout equipment loop. Its principal design function 
is to communicate with the S/C and GSE systems. Communications 
from man to computer is via the "START" (C, R, & K) function 
control panels. The ACE-S/C system utilizes one CUE (communica- 
tions unit executor) to multiplex a maximum of 256 start address, 
i.e., positions from which commands can be generated. The multiplex 
or scan around rate of the CUE is approximately 20 milliseconds with 
priority response being given to the C-START type requests. To 
permit automatic computer generation of uplink commands and still 
retain the manual command features of "Start Verify" and command 
filing on magnetic tape, the computer performs a pseudo manual 
stimuli generation. This is accomplished by using a software 
program referred to as ADAP whereby actual START addresses are 
internally acknowledged by the computer with verification signals 
being transmitted to the STARTS and at the same time a recording 
on mag tape of the command and the address of where the stimuli 
was applied. Stimuli commands are formatted and buffered out over 
serial links to the S/C systems. The rate of data transmission is 
1 mega bit/sec. To assure that possibility of erroneous trans- 
missions are negligible, 100$ redundant transmission techniques 
are utilized. Additionally, double command transmission with a 
comparison test is made prior to stimuli application. Due to these 
error checks and command word size which is 24 bits, the effective 
command execution rate approximates 1000 points per second. A 
coded message which identifies whether or not errors in transmission 
or decoding have occurred in the stimuli operation is returned to 
the uplink computer by the S/C interface equipment. Whereas relay 
activation or discrete voltage generation is the result of one 
complete command sequence, the analog voltage generation is performed 
by a series of voltage command iterations which progressively 
increase/decrease in amplitude at a constant rate determined by 
the computer. To assure that the computer does not exceed its 
real time throughput capacity, a restriction of 4 analog type 
command functions at a frequency of 20 cps has been imposed. Other 
functions requiring service by the uplink computer in real time 
includes: 
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a. Filing special S/C computer (s) error messages as provided 
by the downlink computer. 

b. File all uplink commands. 

c. Reading into high speed core the test checkout sequences 
or programs residing on mag tape. 

d. Outputting on high speed printer a playback of filed S/C 
computer error messages. 

SYSTEM ASSESSMENT 


In our preliminary thinking of what happens on next generation 
S/C checkout, we began asking ourselves Just what is our present 
capabilities. What limitations do we have in ACE and what areas 
should be worked on to make checkout more efficient and thorough. 

Three basic areas for assessment immediately come to mind which 
fairly well defines our areas of investigation or activity. These 
are: 

a. Throughput capacity 

b. Operational aspects 

c. Hardware consideration or techniques 

Increasing system throughput capacity is always a new design 
consideration, the ability to do more work faster and to provide 
more and better information. In the case of ACE, no longer has it 
become a desire. As new S/C come down the line there has been 
ever increasing requests for ACE to do more for the test people. 

It has now reached the point where ACE throughput capacity is a 
significant matter for consideration before approval of new require- 
ments for implementation. 

In order that we might be able to better evaluate ACE capability 
for both present requirements and assist in evaluating future systems, 
a search was made to find a suitable tool, 

IBM’s Simulation Program GPSS (General Purpose System Simulator) 
was recognized as the possible tool. Subsequent work has shown that 
indeed GPSS is capable of supplying us with a simulation tool that 
would give us answers on ACE and future systems. To date we have 
successfully simulated the downlink processing job which is best 
explained by use of Fig. 1 and Fig. 2, 

Fig. 1 represents the entire Downlink Processing for 1 major 
cycle. The area between blocks 1 and 3 is the Interrupt Loop which 
is entered 50 times each second, with blocks 4 to 7 being the 
.Executive Loop, A portion of the executive loop is accomplished 
once each prime frame until complete. 
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Fig. 2 is a representation of how process time is consumed 
over the 50 Prime Frames of a major cycle. It shows the important 
requirement of maintaining program operation synchronous with 
telemetry data arrival. 

Using the GPSS some of the major functions defined earlier 
have been analyzed with the findings presented below. 
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F( x i) s * A * Ni + B • M^ 


millis ec s/P. F.^ 


where 

A - . 027 

N. * Number of Measurements 
Compressed/PF^ 

B a . 0054 

M a Number of Measurements 

1 Relocated/PF J 

• 1 

b. If M^ is equal to 50 then: 

f (XjJ = 3.15 + A.N. i msecs/PF^ 

and for an N^ * 150 

f (x^) » 7*20 msec/PF^ 

The contribution for data Compression (AN) represents 
56# of the total 7*20 msecs. 

c . G & N Data Processing 

m 

f (yi) = .9 + y? T g msecs/PF.^ 

tr*= 1 

For 1 ^ t * m is normally 2 s but may vary from 1 to 15 . 
For eacjh (t) there will be a difference (s). 

where; 

.9 is the time required for data identification 
and househoeping. 

T g is the process time for a unique category (s): 
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T for s * 1 Is .9 msecs for 15 Bit Scaling 
8 * 2 is 1.2 msecs for 30 Bit Scaling 

s 3 is ,1 msecs for Event Display Conversion 
a 5 is .25 msecs for Octal or Binary Conversion 
a 5 is .25 msecs for Or'lng or Anting two bits 
s 6 Is .0800 msecs for Data Piling 

d. Executive Subroutine (s) 

f (z k ) - N k . \ + C k 

where k a subroutine category 

Cfc a Constant usually zero 

N^. a Number of Measurements in category (k) 

Tfc a process time per Measurement in category (k) 

T* for k a 1 is .300 to .500 msecs, for conversions 
K of raw data to engineering units. Add .050 

msecs if calibration data is to be switched. 

a 2 is .268 usees, for Barometric Pressure 
Monitoring. 

= 3 is ,140 usees, for conversion of Altitude 
Voltage to degrees. 

= 4 is .130 msecs, for Time (CTE) conversion 

= 5 is .890 or .222 msecs for S/S or 10 S/S 
Measurements respectively plus C k a .090 
msecs, for OR’ed Event conversion. 

= 6 is .170 msecs, for Binary Display Conversion 

= 7 is .033 msecs, plus C. =.l4 msecs for 
Analog rate of change detection. 

= 8 is .300 msecs, for Inertial Measurement 
Unit (MU) angle conversion. 

OPERATIONAL ASPECTS 


Reviewing the system capabilities in terms of operational 
considerations, one must ask the questions what type of information 
must the C/0 system supply to enable test personnel to make 
decisions on status of system under test; and how does one assure 
that everything - hardware and software - is ready for test and 
working properly « Information required includes: 
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a. System history - what tests have been performed previously 
and what was result of test. 

b. On-line Quick Look retrieval - Display of previous test 
results and system trend. 

c. Real Time Data to assure system functioning during test 
periods . 

d. Status of test progression. 

System history is provided by ACE-S/C via the digital compressed 
data tape, raw analog PCM recordings and strip chart recordings. 

This presently requires the support of a separate data processing 
facility to analyze mag tape recordings and present required output. 
On-line quick look retrieval during periods of testing is accomplished 
by ACE-S/C on a limited and controlled basis. Management of the 
operational testing activity must be very strict if playback is 
requested during real time testing to preclude the possibility of 
losing test data during this interval of time. Systems trends are 
not automatically processed by the ACE computer and operators have 
in the past been known to rely on manual log entries to keep status 
on system operation. Real time test data is now provided by ACE 
via the computer driven A/N CRT's. Twenty selectable pages of a 
fixed format (fixed for any specific test) is available to all 
system test personnel. 

Test progression status in S/C checkout is strictly a manual 
function. The majority of sequencing from test to test is performed 
by verbal directions read from the OCP (Operational Checkout Pro- 
cedures) by the test conductor. The verbal directions are then 
accomplished by the system test operators using the C-R-K START 
entry controls for ACE computer controlled functions. In the event 
a significant amount of automatic test sequencing is implemented, 
some form of progressive status display will be required. The ACE 
Software Program ADAP supplies this now to a limited degree. 

Verification - One of the most significant problems faced by 
ACE-s/C to date has been that of systems (hardware and software) 
verification prior to start of test. Recognizing that improper 
hardware patching or incorrect computer coding can cause commands 
to be executed which could be catastrophic to S/C and personnel 
has caused much investigation by ACE system designers to prevent 
such a happening. Such concepts as using boiler plate S/C or house 
type S/C for dry runs have been investigated. Due to the fact that 
S/C are not a production type article and are continuously changing 
configuration, makes this approach not feasible. The concept now in 
practice by ACE is to perform a dry run of the test OCP using a 
simulated PCM input from magnetic tape. Through this technique, 
routing of data within the control room, through its patch boards, 
is verified as well as the CRT display format. Operation of the 
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C-R-K STARTS are executed which results in a command transmission 
which is then checked for proper address or routing of stimuli and 
the data transmitted. Since the present technique is very time 
consuming and requires considerable manpower* improved methods for 
hardware/software verification is of prime concern in any new 
system concept. 

HARDWARE CONSIDERATIONS 

Reliability - Although reliability of ACE-S/C hardware was a 
consideration in its initial design* only in the last year and a 
half has the importance of ground support equipment reliability 
become so recognized. Control of systems test from remote locations* 
coupled with the desire to provide more automatic control of testing* 
has pointed out the requirement for a continuous and absolutely 
reliable command link with the systems under test. In the case of 
such ground tests as engine firings or fuel cell control* the loss 
of ability to control becomes as big a problem as that of executing 
improper commands. The ability to automatically execute successive 
commands based upon system response imposes a significant reliability 
requirement on the response system and the communication link. 

ACE-S/C hardware system design goals worked this reliability 
problem in several ways: 

a. Switch capability to allow interchangeability of 
computer/control rooms. 

b. Redundant Decoms 

c. CRT Display backed up by decom driven events and analogs. 

d. Ability to back up R-START entries with C-STARTS. 

e. 100$ redundant transmission of serial command data. 

f . Redundant load and check modes of DTCS System. 

ACE-S/C experience has shown that reliability of operation or 
backup consideration should be worked from a functional aspect rather 
than hardware backup. This is to say that providing redundant or 
parallel hardware in itself is not a sufficient consideration. System 
design must provide functional organization so that computers can be 
cross checking and assure each other’s critical functions in the 
event one unit fails. Considering the remote control problem* new 
system design should provide the test article interface hardware with 
the necessary power and functional capability to fail safe or have 
adequate functional bypass. A point of interest is the ACE genera- 
tion of periodic analog functions. Intermittent loss of data results 
in distorted wave shapes or erroneous signal levels. 

Test Preparation and Verification - Routing of ACE controls and 
responses are controlled primarily by patch boards and junction boxes. 
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:» »*lflcation of patching and routing is performed manually to 
:> munr.trate that proper displays are driven and stimuli exists 
.1. the proper test points. 

The ACE DTCS hardware provides logical checks up to the data 
■ Jeter. Feedback, or closed loop checks on data signal existence 
is not performed. Verification that the ACE-S/C DTMS is correctly 
accessing and processing data is principally one of manual hard- 
ware checks or testing. Although verification is accomplished, 

■ !»<• time element becomes significant in this age where time is 
directly related to money. Repeatability or elimination of human 
'•Torn is another goal to be achieved by automating verification 
'trough hardware design. 

CO MPARISON WITH OTHER SYSTEMS 


Since the implementation of the ACE- S/C System, several other 
*:/Q systems have been developed whose checkout role is similar to 
that of ACE-S/C. It is of some interest to correlate these systems' 
•rap abilities and philosophies against those of ACE. In the follow- 
in,''; material reference to the system will be made by its develop- 
fa’ ui period, i.e., mod 66 is system designed in i960. 

Number and Type of Computers 

Mod 67 uses two Central Processing Unit (CPU) and associated 
peripheral devices as the Central Control Unit of the Data Process- 
ing Subsystem. Mod 66 uses one Central Processing Unit and ACE-S/C 
uses two (2) Control Data Corporation 16OG computers as the central 
control units. Cycle times are as follows: 

Mod 67 Memory Time = 850 Nano seconds 

Mod 60 Memory Time = 1.50 Micro seconds 

ACE CDC l6QG - 1.35 Micro seconds 

Mass Memory 

Mod 67 uses two (2) Random Access Disc Memories, each with a 
capacity of two million characters. These Discs are used as part of 
both the on-line test equipment configuration and the off-line 
support system. Test sequences and randomly used test programs 
(Contingency and fault isolation routines) are stored on the disc 
for on-line use as well as historical data for trend computations 
and post- test processing. Mod 66 employs one Random Access Disc 
with a two million character capacity, and access time of 34 milli- 
seconds (17 millisecond average). Usage is primarily on-line for 
test sequence storage, on-line computer operations and test data 
storage. ACE-S/C has no mass memory storage devices at this time. 
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Core Memory 


Mod 67 uses shared memory banks for a total of 80K words of 
• ;or». memory. The two CPU's have access to all memory banks. 

Mod 00 uses three memory banks one, 16 K bank (CPU Basic 
M»t:;or.y), and two 8 k banks (One bank for PCM input and A/N Display, 
at id c^e bank for command and discrete response data). Total core 
is 4 OK words. 

ACE-S/C has a total core of 40E words * ( 8 K in each CDC 

i * OG computer model with three 8 k shared memory banks). Two 
'.‘Xternal banks are assigned to PCM input, processing and A/N 
idsplay, and one external bank for command data storage and 

I >*! '(tensing. 

Program Memory Lockout 

The Mod 66 System has Program Memory Lockout which permits 
mumiu’y guards to be set up by the software. These guards can be 
assigned In blocks of 512 words and will prevent those areas from 
r Lng written into, such as on an I/O failure, program error, 
peripheral device failure, etc. ACE-S/C and Mod 67 do not have 
this feature. 

Power Fail Safe Feature 

The Mod 66 System has Power Fail Safe features which causes 
the contents of programmable arithmetic registers to be saved 
(stored) if power fails. ACE-S/C and Mod 67 do not have this 
feature and as a result the programs must be recycled to a pre- 
determined initialization point upon a return of power to the 
system. 

PCM Data Recording 

PCM data is recorded on analog tape in the Mod 66 (2 tape 
units) and ACE-S/C (3 tape units) systems. The Mod 67 System has 
one PCM analog recorder. 

Independent Critical Function Monitor 


The Mod 66 system contains provisions for monitoring up to 
76 critical functions, as hardlined from the test area, at the 
operator control consoles. These functions are available to the 



i ;pvi‘ or a g inputs for status chocking but the computer has no 

interface with these hard lines, ACE-S/C and Mod 67 have 
.•it' such "independent H monitor capability as a part of the ACE-S/C 
>■ Mod ti( checkout system. Both systems, however, have critical 
r (notion monitor personnel stationed outside the control rooms with 
no interface, either active or passive, with the checkout system 
**» -input ers . 


Independent Safina Controls 

The Mod 66 system lias provisions for twenty- four ( 24 ) hard- 
! 110 * control functions available to the console operator. Data 
from these lines arc available as inputs to the computer but no 
'ommand interface is available. Mod 67 system design includes 
provisions for manually controlled switcnes on the Launch Control 
ifnsolo, hard lined to the discrete events rack to accomplish all 
required "safing" of the vehicle. This is designed as backup to 
r 1 ; f ! automatic safing capability of the software system. ACE-S/C 
has no independent hardline command lines for emergency safing 
■oni, rol "as an integral part of" the ACE-S/C system. Such command 
j hies are available but with no interface with the ACE-S/C computer 
system or ACE-S/C consoles. 

Simulators for Closed Loop Verification & Fault Isolation 

Both Mod 67 and Mod 66 design description indicate that hard- 
ware simulators will be available to "close the loop" between the 
command transmission system and the Data Monitoring System. At 
this time ACE-S/C has no such hardware simulators for closed loop 
program verification and/or fault isolation. 

Internal Computer Clocks 

Mod 67 and ACE-S/C each have countdown and real time available 
as inputs from external equipments. In addition, the Mod 67 system 
includes two "Delta timer" units (one for each CPU), each of which 
allows the software to request up to eight ( 8 ) interrupts when the 
pre-set delta times expire. ACE-S/C has the capability of request- 
ing an interrupt upon expiration of a delta time interval, but only 
one at a time. 

CPU Fault Timers 


The Mod 67 system console I/O units contain two "watchdog" 
timer units (one for each CPU). During normal operation the CPU’s 
periodically, via direct I/O pulsed outputs, provide a reset command 
to these timers. If one of the timers "times out" (i.e., if the CPU 
does not reset it) the timer locks-up, lights a light on the console. 
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•in* 1 provides an interrupt to the other CPU. Once this occurs, the 
:pu can only be reset through a CPU restart procedure which includes 
a CPU Self Test. 

Console/Command Inhibit Feature 


The Mod 67 system has the ability, either through console 
operator input or pre-programmed procedures, to "danger tag" any 
command to Inhibit transmission. The Mod 66 system has console 
lockout features which require that the test conductor "unlock" 
any operator console before any active command can be initiated 
from that console. Otherwise, the console is in a passive/monitor 
mode, ACE-S/C has neither of these capabilities. 

Command Transmission 


In the case of both Mod 67 and Mod 66, great emphasis is placed 
upon decreasing the probability of transmitting an erroneous command 
a ;j a result of a hardware failure in the uplink system. Data 
presented on at the Mod 66 System indicated that the probability 
tvs’ transmitting an erroneous command due to hardware failure is 
b.19 x 10“ 11 or one command in 1.9^ x 10 10 commands. The Mod 67 
System presents no statistical breakdown of failure mode effects 
Imt the design criteria that "no single failure shall cause a 
hazardous condition for the vehicle or personnel" results in the 
inclusion of the "majority voted stimuli" system, and in the 
proposed redundant operation and configuration of the computer 
system. It should be noted that this redundancy along with the 
various features, such as the CPU Watchdog Timers, and redundant 
Delta Timer Units, also provides Mod 67 with a negligible proba- 
bility that a command will NOT be transmitted when it should be 
(such as the reset command for a momentary relay closure, etc.). 

That is, this redundancy precludes the possibility that a computer 
halt or malfunction will result in NOT transmitting a command that 
should be transmitted. The Mod 66 and ACE-S/C Systems have no such 
protection. In this case what is required is to provide rapid 
alarms that a failure has occurred, and manual backup capability 
for safing the test article. The operation and procedure for such 
actions in this circumstance are hot available from the mod docu- 
ments . 

Data Display 

The Mod 67 design description, since it contains descriptions 
of the software and general test philosophy, indicates how the 
operator consoles will be used. The Mod 67 System is a "Management 
by Exception" system wherein only those data which have changed or 
are specifically requested are routed to the displays. The CRT’s 
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'•i* to be used for both data and cc nments (roughly one half page 
)V each). The comments originate from the test sequence Itself 
•* from operator keyboard input. The operator has a " selective 
■RT erase and save’ 1 option, as well as the capability of requesting 
r-ond calculations and plots (i.e., get present values of measure** 

>*nt XX and plot it, indicating when it will go out of limits). 

JE-S/C CRT page are pre-specif led by the software without selective 
•it a requests available to the operator other than page changing. 

sdE II 

Concepts - Introduction 

Design and development of a new generation checkout system 
M.’.t not reflect only an attempt to improve hardware functions or 
resolution of present day system limitations. After working 
. Uh the present Apollo Program and Manned Spacecraft checkout, 

‘ j. appears to us that a significant change in operations concept 
•;i applicable. Experience to date indicates that checkout is really 
w o basic jobs which must be accomplished by one total system which 
tightly integrated together. One job is that of real time pro- 
nging which is recognized as being stimulus generation, response 
/aluation and automatic progression of testing based on Go/No Go 
,/stem outputs. The term automatic checkout is probably most 
pplicable here. Any other concept of automated checkout is almost 
impossible to define. Hardware design to permit this automatic 
••tion is well understood and requires only the proper management 
direction at time of original system design. It is felt, also, that 
" !.’ this type of automatic concept is incorporated, it is best to 
locate the necessary hardware power as close to the test article 
possible. This accomplishes three objectives: 

a. Minimizes personnel operating or interference with the 
automatic checkout operations. 

b. Allows for more reliable system operation since hardware 
linkage errors due to distance and transmission mediums 
are reduced. 

c. Permits individual system testing with a minimal equipment 
complex. 

The second job that a checkout system must accomplish is that of 
data management and a man/system interface. The task of data manage- 
n‘-nt is a near- real time world which should become a data by exception 
i‘ motion. Test status information, post test and quick look analysis, 
control over the overall test progression, availability of detailed 
systems response data, and capability to override or provide backup 
to the automatic portion of the system. 


17 - 


I) IK IGN - GENERAL 


General purpose digital computers will be used with a multiple* 
non-dedicated central processor configuration being employed. This 
approach provides several modes of operation which are acceptable 
despite failure of a ma,Jor component, such as a memory bank or a 
processor. Capacity and computational power are greatly increased 
to provide additional on-line processing. Storage of historical 
data for real-time or near real-time retrieval will be possible with 
the inclusion of mass storage* devices (drum/disk) . 

The system employs command storage* data processing and data 
compression within the immediate vicinity of the spacecraft* thereby 
eliminating total and constant dependence on the transmission link 
between the data processing and control area and the test vehicle. 

The remote portion of the system will utilize a small processor for 
initiating programmed sequences of stimuli commands. The processor 
will ascertain that the resulting measurements and prerequisite 
conditions are satisfactory for continued test operation. 

The control and display consoles are reduced in quantitative 
display provision. A dual CRT system provides simultaneous real 
timo data display in any desired format and selectable historical 
data for reference to system parameters. The computational power 
will provide for routine correlation of events and evaluation of 
analog data with the results presented on summary displays and 
alphanumer ic CRT ' s . 

Control of spacecraft testing in provided by alphanumeric 
keyboard and "fixed function" command entry panels. Some hard- 
wired functions are incorporated for emergency control. 

Data Recording and Analysis will be provided by analog magnetic 
tape recorders* high speed printers* CRT hard copy devices* and strip 
chart recorders. A log typer will provide computer entry from the 
recording and analysis area. The principal function of this sub- 
system to provide* in a variety of formats* a record of information 
which may be reviewed or analyzed in relation to time and other 
functions . 

Spacecraft Vicinity Equipment Description 

The Spacecraft vicinity equipment provides the following 
functions: 

a. Command reception and reformatting from the central computer 
area. The 24-bit command messages include both specific 
stimuli generation words and instructions for the sequence 
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and relationship of the commands given and response 
received. 

b. Storage and execution under self control of these 
command sequences. This is accomplished with an airborne 
type general purpose digital computer. 

c. Stimuli function generation. Tb3se stimuli may be sine 
waves , contact closures , DC levels, square waves, tri- 
angular waves, complex waveforms and digital words. 

d. Measurement collection and conditioning. Data will be 
gathered from addressable sensor channels. This design 
provides reduced data transfer and complete flexibility 
of sample rates. The sample sequence and frequency will 
be determined from a stored memory control unit which is 
loaded via the remote computer. Signal conditioning is 
provided tr bring the GSE and Spacecraft testpoint- voltages 
to the programmer working levels. 

e. Measurement checks - The programmer will perform a fixed 
and floating limit check on the analog data and store the 
data in its memory for access by the computer. The airborne 
telemetry will also be routed through the remote computer 
interface circuitry for access. 

The stimuli generation and measurement collection equipment will be 
modular and the power and word structure will be sufficient for 
expansion to handle future application. 

The external interfaces of the remote system are 1) computer- to- 
eomputer 24-bit digital command and program loading link. This 
transfer is approximately 1 million bits per second, when active. 

2) Serial checkout data - 24-bit GSE and S/C data plus address. 

This transfer is at a rate of one million bits per second. 

3) Airborne PCM measurement data at 51.2 KC with 8-bit words. 

4) Bypass command link - This is a 24-bit serial line to provide 
backup command capability in the event of remote computer failure. 

Central Computer Complex Description 

The Computer Complex System performs the functions of test 
control, data processing, command/response relationship evaluation, 
command recording, and measurement data formatting for display and 
recording. 

The computing system consists of 3 (number dependent on processor 
power) central processor units, approximately 125 thousand 32-bit 
words of core memory, and 3 Input/Output processors which effect 
data transfer between memory and peripheral devices. The peripherals 
include the following: (quantities are approximate) two mass storage 

devices such as disks and/or drums 5 six tape transports, a card 
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reader., a card punch, two high-speed printers, telemetry 
processors and a computer data translator. 

The CPU’s and the Input/Output processors are interconnected 
in such a manner as to allow control and access to each other’s 
assigned memory and devices. This, along with proper software 
control allows the failure of one of these devices and the assumption 
of its assigned duties by another of the identical hardware units. 

The prerequisite condition for this "failure absorption mode" is 
partial loading or the relegation upon failure, cf some nonessential 
real time activity, such as data stripping, to a post test job. 

The hardware and software will employ failure sensing to effect 
the job transfers, i.e., parity error checking, power sensing, 
timers to prevent program hang up, etc. 

One of the more significant data processing jobs of the 
computer complex is the compression and storage of measurement 
values within closely specified tolerances for real time retrieval 
and display to provide historical and trend predictior for the 
test engineer. 

Control and Display Subsystem description 

The Control and Display Subsystem will contain human factored 
conooles with alphanumeric and fixed function keyboard entry controls 
and alphanumeric and graph plotting CRT displays. Among the fixed 
function keys will be hardwired critical or emergency controls. 

Event indications will also be provided as outputs from the Input/ 
Output processor; these events will be summary or computed type 
events as well as raw S/C and GSE events which are significant 
enough within themselves to warrant constant test engineer surveillance. 
The CRT System will be capable of CCTV presentation, with camera 
select control. 

Other pushbutton or thumbwheel type controls will provide the 
selection of test modes such as single step or automatic and direct 
program control such as Hold, Master Clear, Keyboard Execute, Update 
Hold, etc. 

Special control and monitor devices will be required on the Test 
Conductor and Bio-Med Consoles to accomplish their unique functions. 
Also, a facility monitor console will be custom-designed for the 
unique nature of facilities such as test chambers at MSC. 

Generally speaking, the other consoles will be identical, with 
the basic design being based on the quantity of control and display 
required by the largest flight article subsystem. The consoles will 
receive and generate serial data in their interface with the Input/ 
Output processor. This approach provides simpler, more reliable 
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interconnect cabling* thereby allowing the introduction of data 
distribution check circuitry to verify the fidelity of the console 
data bus. 

Data Recording and Analysis Subsystem Description 

The recording and analysis equipment will provide recorded 
raw data* processed data and derived data for analysis oy the test 
engineers and analysts. This capability allows a determination 
within minutes or hours after the actual test operation* whether 
or not the vehicle and/or facility operated satisfactorily. 

Digital magnetic tape recorders will be utilized to record 
the raw data from the remote area for possible future use. The 
data* of course* will have been remotely compressed to eliminate 
unnecessary tape usage. 

Strip charts will be used to trace analog data for time and 
inter- measurement correlation. A logging printer will be used for 
event recording against time. The channels assignments may be 
changed during the course of the test to achieve maximum data 
relativity and provide efficient recorder usage since the data 
is input from the computing subsystem. 

The CRT Photo Recorder will capture for post test analysis and 
reference* those conditions which are significant to the test 
engineers course of action and which precipitate a test decision. 

This subsystem provides a very significant capability in 
conjunction with the increased computational capability of the 
system. The tempo of spacecraft checkout does not permit any 
residual review or qualitative (how good or how bad) analysis in 
real time. However* efficient and successful test operations 
consistently require a qualitative judgment based on very recent 
or just completed completed test data. 

Time code generation* real and countdown* will be provided by 
this subsystem for recording and distribution to the computing and 
control and display subsystems. 

Automated Facility Interface 

Control and monitoring of facilities such as the chambers at 
MSC will be treated in a manner similar to the S/C system. A S/C 
vicinity type system will control and monitor the facility* under 
the Central Ground Station Control* in the same manner as the S/C 
systems are managed. 
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The Computer Complex, Control and Display and Data Recording 
and Analysis are compatible with the monitor and integration of the 
facility data. This integration becomes very desirable, if not 
mandatory, during spacecraft checkout to relate the performance 
of each to the other. 

The capability for control of the facility from the Facility 
Consoles within the control room will exist with the development 
of sufficient computer software to perform the large number of 
individual functions. 

S/C INTERFACE EQUIPMENT DEVELOPMENT 

General 


It is possible to design the most sophisticated, automated 
checkout system available and yet not be able to efficiently 
checkout the spacecraft. A link or interface must exist between 
the checkout station and the system under test. This Interface 
Equipment must be such that it augments total system capability, 
rather than becoming the proverbial weak link. It should be 
designed such that certain mundane but necessary tasks are per- 
formed independently, thereby freeing the Control Stations for 
more efficient operation. The hardware should be designed with 
software in mind, and trade-offs performed. It then becomes 
possible to define complete tests that are better performed at 
the S/C by the Interface Equipment. The next logical step is to 
give the Interface Equipment a dec is ion- making capability, thereby 
providing more flexibility. Once this is done, closed loop testing, 
i.e., command/response verification, becomes possible and the Central 
C/0 Station is free to do its data processing, reduction, display, 
etc., more efficiently. After this type of analysis is made, it 
becomes readily apparent that this area is one whereby many improve- 
ments can be made, at a relatively low cost, to the present ACE 
System. To this end, inhouse work has been going on at MSC utiliz- 
ing NASA/Contractor personnel to develop a prototype system to replace 
the present S/C interface equipment (DTCS/DTMS). The remainder of 
this paper is concerned with delineating the progress that has been 
achieved, and the approach taken. 

System Design Philosophy 

The primary purpose of the ACE II Remote System, as explained 
above, is to provide a flexible spacecraft interface for the ACE 
Ground Station for future as well as present S/C checkout. While 
future requirements are not clearly defined at this time, current 
requirements serve as guidelines. In addition, current problems are 
also well-known (unfortunately) and could be analyzed. Howevbr, the 
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ADVANCED SYSTEM REQUIREMENTS 

1. PROVIDE THE CAPABILITY FOR INDEPENDANT OPERATION TO 
FACILITATE CLOSED LOOP TESTING AND FAULT ISOLATION 

2. INCLUDE THE MEASUREMENT & STIMULI REQUIREMENTS OF 
THE PRESENT CARRY ON SYSTEM WITH EXPANSION CAPABILITY. 

3. PROVIDE CONTINUOUS SAMPLING OF MEASUREMENTS AT 5 
TIMES THE RATE OF PRESENT DTMS. 

4. IMPROVE THE STIMULI CAPABILITY BY PROVIDING SOLID 
STATE SWITCHES, PROGRAMMABLE FUNCTION GENERATOR 
AND PROGRAMMABLE LENGTH DIGITAL WORD GENERATOR. 

5. INCLUDE PROVISIONS FOR MONITORING FLIGHT PCM 

6. PROVIDE A MEANS OF SOFT WARE VERIFICATION. 


SYSTEM FEATURES & CAPABILITIES 

1. BACK UP MODE OF OPERATION IN CASE OF COMPUTER FAILURE 

2. REMOTE MEASUREMENT & STIMULI CAPABILITY 

3. BUILDING BLOCK TECHNIQUES UTILIZED IN PACKAGING TO 
PROVIDE FLEXIBILITY & EXPANSION CAPABILITY 

4. CONTINUOUS MONITORING OF EMERGENCY TYPE INPUTS 

5. HIGH SPEED MEASUREMENT - APPROXIMATELY 30 /iS PER CHANNEL 

6. FLEXIBLE MEASUREMENT SAMPLING RATES & PCM FORMAT - 
DETERMINED BY PROGRAMMABLE SEQUENCER 

7. CAPABILITY TO INTERROGATE & DISPLAY CURRENT STIMULI 
OUTPUT STATUS 

8. CAPABILITY PROVIDED FOR THE COMPUTER TO ACCESS ANY 
FLIGHT PCM PRIME FRAME 

9. BUILT IN MODULE CHECKOUT CAPABILITY 

10. FLEXIBLE DISPLAY & CONTROL - DETERMINED BY SOFTWARE 
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remote system design was not based on solving these problems alone, 
but, an effort was made to determine the most flexible, efficient 
spacecraft interface for ACE. It follows that the basic design of 
any future ACE II Ground Station will be somewhat influenced by 
the Remote System Design. This appears desirable since a fully 
Integrated spacecraft checkout system, from the ground station to 
the spacecraft will then exist, thereby providing for complete 
automatic closed loop checkout or any degree thereof. A basic 
block diagram of the development system is shown in Figure 1. 

There are four modes of operation availably to the Remote 
System. These are a) completely automatic, b) ACE Ground Station 
Mode, c) monitor mode, and d) fault isolation mode. 

Automatic Mode 


In the Automatic Mode test sequences are loaded into the 
Remote Computer Memory from the ACE Ground Station CPU. The 
Remote Compute then loads the proper PCM format into the 
sequencer memory. At this point, monitoring sequences would 
begin. The Data Acquisition System has a basic capability of 
32,000 words per second. There is no longer a continuous PCM 
stream sent to the Decom. Instead, the Data Acquisition System 
functions as follows: 

A word is first read from the sequencer memory. This word 
contains the address of a data point in the Remote Measurement 
Unit. This address is transmitted serially at 5 me to the proper 
RMU and is decoded to enable one data point. Certain error 
checks are made to insure the proper data point response. The 
RMU then sends a 23-bit word back to the Sequencer and Control 
Unit. More error detection checks are made, along with both a 
fixed limit check and floating limit check. Then, at the proper 
time, the data, including the address and results of the limit 
check are gated to the Ground Station at 1 MB. A buffer interface 
unit at the ACE Station then provides for direct memory access to 
the computer, or can provide a direct driven display capability. 
The data is also available to the Remote Computer, along with 
coded interrupts, if any of the error or limit checks fail. This 
process is repeated every 31* 2 >useconds . In addition, every 640th 
word contains a prime frame count from 1 to 50 * 

This approach has the advantage of providing a dynamic data 
acquisition system to replace the static DTMS . Some of the major 
differences are: 
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a. A flexible data point address selection that makes avail- 
able any sample rate up to 32K/sec., and is changeable by 
software. 

b. Error detection that certifies the data is actually data 
from the data point addressed. 

c. Fixed limit checks at the S/C vicinity for prompt corrective 
action if necessary. 

d. Interrupt capability to allow the remote computer a flexible 
interface. 

e. All data is available to the Remote Computer when desired 
with no sync or look-up tables required. 

f. Floating limit checks are performed by a combination of 
hardware/software in the vicinity of the S/C and made 
available to the Ground Computer. 

g. Sync problems are eliminated since there now exists word 
sync in the form of an address, and prime frame count. 

h. Direct memory access to the ACE Computer is provided. 

i. Direct driven display and/or recording capability is 
provided . 

j. A 1 MB transmission rate makes available the necessary 
time for a parity error encoding check to insure against 
transmission errors. 

k. An interface is provided for the Remote Computer to 
generate data point addresses for fault isolation,, and 
to reduce the danger of single point failures. 

l. Cabling reduced to one cable per RMU. 

The Critical Monitoring Unit, an independent portion of the Data 
Acquisition System will provide 2 functions. The first function 
is constant monitoring of up to l6 selected critical functions. 

These will primarily be threshold detection type functions that 
will interrupt the Remote Computer when a critical limit is 
exceeded. This approach deletes the necessity of having to 
provide extremely high sampling rates in order to detect a 
failure, thereby relieving the RMU to do its job more efficiently. 

A second function of the RMU is to provide real time waveform 
analysis of gliches on 6 power busses. The lack of this capability 
is a current problem and would definitely be a future one. When a 
glitch occurs on any one of the six busses, the data would be digitized 
and sent to the ACE Central Computer over the uplink communication 
lines. There the glich could be reconstructed. Again, this 
eliminates the necessity of a high sampling rate in the normal 
PCM data. 

In summary, the RMU provides the following functions, none of 
which are being presently performed: 
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a. Independent, constant critical monitoring of up to 1 6 
measurements with interrupt capability to the Remote 
Computer for prompt analysis/corrections. 

b. Constant monitoring of S/C power busses and real time 
reconstruction/analysis of power glitches to allow 
accurate S/C system troubleshooting. 

c. Both functions performed independent of the RMU and do 
not fill up the PCM format. 

The Stimuli Equipment is under direct control of the Remote Computer 
in the Automatic Mode, with ACE retaining an override capability 
on the Bypass Link as well as the computer-to-computer link. A 
RSU has three types of commands issued to it. These are load, 
execute arid interrogate. Upon receipt of a load command, certain 
conditions are set up to prepare for the execute command. The 
execute command then applies the stimuli to the S/C system under 
test. The interrogate command does not apply or change any stimuli 
but allows a means of determining the state of the stimuli modules 
if desired. There are four basic types of stimuli modules. These 
are Relay, High Current Solid State Switch, Programmable Digital 
Word Generator and Function Generator Modules. The output of any 
of these modules can be monitored by having the computer access the 
sequencer memory of the Data Acquisition System at any time. In 
addition, the Function Generator may be set up, verified on the D/L 
and then switched to the S/C by the Remote Computer. A provision 
is also available for sampling the output after applying it to the 
S/C through the RMU A/D convertor. 

The basic advantages of the RSU approach are: 

a. Single cable for each RSU utilized. 

b. Internal switching available thereby eliminating problems 
associated with using C14-202. 

c. Function Generators relieve computer load. 

d. Solid State Switches provide faster, reliable operation. 

e. Programmable digital word generator fulfills present 
requirements of both the G & N Buffer and the 410-31110 
AEA Buffer, as well as being flexible for any future 
Digital Word Requirements. 

, f. The system operating speed increased by a factor of 20 
or greater. 

g. System is inherently designed to function with the RMU/ 
Remote Computer for a closed loop testing. 

h. Interrogate mode available to determine state of the RSU 
at any time . 

i. All Function Generators may be verified before applying 
to the S/C and at any time desired thereafter. 

'In'.: RSU is not presently being developed, due to manpower shortage. 
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However, a substantial portion of the design Is complete and 
development will begin as soon as possible, 

ACE Ground Station Mode 

Two uplink lines provide communications between the Remote 
System and ACE Stations. The normal test loop is a computer-to- 
computer link as described in Paragraph A (automatic mode). 

However, a bypass link is provided whereby the ACE CPU can lock 
out the Remote Computer and take over stimuli generation. Complete 
sequences such as ADAP could be run, or manual entry of commands 
from R-STARTS, etc. could be exercised. The downlink data would 
be unaffected by this action and would continue to be processed 
in the normal manner. However, the primary function of this link 
is to eliminate a remote computer failure from halting testing, 
with the S/C in an unsafe condition. Since the Remote Computer 
keeps the ACE CPU updated as to the point in test, and since an 
interrogation mode is available in the RSU, the change-over from 
Remote Computer Control to ACE CPU control should be affected with 
a minimum of hold time. 

Monitor Mode 


In the Monitor Mode no stimuli commands are being generated 
by the Remote Computer. The D/L functions as in automatic mod 
with all limit checks being performed and the data being processed 
as usual. During this mode of operation the data point addresses 
may be generated by the sequencer and control memory or by the 
remote computer. This approach has the advantage of making 
available a redundant path for providing these addresses. 

Fault Isolation Modes 


The Remote System has an inherent design capability which 
facilitates fault isolation. Both the RMU and RSU are dynamic 
subsystems and respond upon receipt of commands. Address capability 
is included down to a replaceable module, with the computer having 
the ability to determine the faulty module by analyzing the response. 
The address of the faulty module can be displayed and the module 
quickly replaced. The fault isolation subroutine may be run auto- 
matically by the Remote Computer, or manually from the display sub- 
system. It follows that a hold in testing must accompany this mode, 
but the design of the RSU and RMU are such that the down time will 
be minimal. In addition, the RMU may still function in the monitor 
mode only if the problem resides in the RSU. 


- 26 - 



* 


SYSTEM DESIGN DESCRIPTION (GENERAL ) 

The basic system design is shown in Figure 1. Everything 
except the Remote Stimuli Unit and its interface is currently 
being developed. The logic family selected for use was the 
Honeywell 3C micro-pak 5 megacycle line. This logic was selected 
for several reasons. First* it provides a quick efficient means 
of breadboarding up circuits since the integrated circuits are 
already mounted on plug-in cards. Racks are available with both 
taper pin or wire-wrap connections for ease of subsystem assembly. 
Second* the logic family itself is quite complete leaving only 
special purpose parts to be purchased from other vendors. 

Examples of this are the General Instruments analog switches* 
which can be mounted on blank 30 paks for ease of assembly* and 
the Analog to Digital Converter by Bunker-Ramo. t The A/D selected 
for evaluation uses a cyclic* continuous tracking conversion 
technique. With this approach a 1 mega-word/second rate is 
available. This speed* in conjunction with 5 MC intersystem 
signal transmission* makes available the 32K/sec. PCM word rate. 


The logic to be used in the Remote Stimuli Unit is available 
as surplus from cancelled programs. These are the 1 me potted 
modules currently in storage in the CSB development lab. As 
manpower becomes available* design of the RSU will begin. 


Computer 


At present* the Univac 1824 Computer* on loan from the AF* 
will be utilized. This is a special purpose computer with very 
limited capability and is being used only to demonstrate system 
concepts. One ground rule being emphasized is that the Remote 
System Design will not be influenced by the use of this computer. 
Any special interface equipment required will be external to the 
Remote System. As the design proceeds* specifications will be 
written* based on the design* for an ultimate computer. Where 
* certain functions can be performed by software or by hardware* 
trade-offs will be determined and the approach deemed most feasible 
taken* based on the results of these trade-offs. A block diagram 
of the 1824 is shown in Figure 2. 


Display Subsystem (General) 


A limited display capability will exist in the Remote System. 

•The status of the 16 critical measurements will be continuously 
displayed. In addition* the operating mode will be displayed. 
Under computer control* any ’’out of tolerance” measurement points 
may be displayed. In the fault isolation mode only* command may 
be generated to either the RSU or RMU and the results displayed. 
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CONTROL l DISPLAY CAPABILITIES 


CONTROL 

1. SELECT & EXECUTE A PRE-STORED TEST OR SEQUENCE 
OF TESTS. 

2. COMPOSE & STORE A NEW TEST OR SEQUENCE OF TESTS. 

3. CHANGE OR DELETE PRE-STORED TESTS. 

4. INITIATE FAULT ISOLATION AND VERIFICATION ROUTINES. 

5. INITIATE SAFING ROUTINES. 

6. HALT A TEST IN PROGRESS. 

DISPLAY 

1. ANY MEASURED PARAMETER. 

2. PRE-STORED TESTS. 

3. PRESENT STATUS OF STIMULI. 

4. STORED LIMITS OR CONSTANTS. 

5. ANY STORED DATA. 

6. TEST RESULTS. 

7. STATUS OF EMERGENCY INPUTS. 


CONTROL & DISPLAY CAPABILITIES 

CONTROL 

1. SELECT & EXECUTE A PRE STORED TEST OR SEQUENCE 
OF TESTS. 

2. COMPOSE STORE A NEW TEST OR SEQUENCE OF TESTS. 

3 CHANGE OR DELETE PRE STORED TESTS. 

4 INITIATE FAULT ISOLATION AND VERIFICATION ROUTINES. 

5. INITIATE SAFING ROUTINES. 

6. HALT A TEST IN PROGRESS. 

DISPLAY 

1. ANY MEASURED PARAMETER. 

2. PRE STORED TESTS. 

3. PRESENT STATUS OF STIMULI. 

4. STORED LIMITS OR CONSTANTS. 

5. ANY STORED DATA. 

6. TEST RESULTS 

7. STATUS OF EMERGENCY INPUTS. 


During normal testing* however* the Display System will be locked 
out and prevented from generating commands. The Display Unit to 
be used has not been defined at this time. 

Flight PCM Unit (General) 

An interface to extract selected Data from the A/B PCM 
data stream will be provided. Basically* it will allow the 
Remote Computer to stay in sync with the A/B data stream and 
extract only those words it is interested in. This alleviates 
the memory storage problem of the 1824 Computer. 

160G Translator 


The checkout PCM stream* normally interleaved and sent to 
the Decom* will now be transmitted on separate link to a l60G 
Translator. The translator receives the 1 MB signal* performs 
certain checks and then generates a unit cycle directly into 
memory. Words 1* 64l* etc. up to word 32*000 are special ID 
words* containing the PF count. Thus* there are 50 prime frames 
of 640 words each. 

The incoming message is composed of 25 bits. Eight of these 
are data bits* 12 address* two parity and three coded error bits. 
The 25 bit word is first gated into a holding register. A check 
is then made to determine that valid data is available. Next the 
two parity bits and the 12-bit address is checked to ensure against 
transmission errors. If all is in order at this point, processing 
will begin. Alternate prime frames of data* odd and even* as 
determined by the prime frame count* will be loaded into separate 
sections of memory. In addition* the words are packed by sample 
rates* i.e.* all the 50 s/s in sequence* 60 s/s* and so on. This 
is accomplished by using the 12-bit address portion of the incoming 
25~bit data word* as a location in memory. In addition* 3 of the 
incoming bits are coded to represent 1 of 8 condition* as shown: 
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B 


1 


0 

0 

0 

0 


1 

1 

1 


0 

0 

1 

1 

0 

0 

1 

1 


0 - Good Word 

1 - Not Out of Tolerance Floating and Out of 

Tolerance Fixed* Low 

0 - No Data were available 

1 - Not Out of Tolerance Floating and Out of 

Tolerance Fixed* High 

0 - Out of Tolerance Floating and not Out of 

Tolerance Fixed 

1 - Out of Tolerance Floating and Out of Tolerance 

Fixed* Low 

0 - Prime Frame Count 

1 - Out of Tolerance Floating and Out of Tolerance 

Fixed* High 
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PRE^ENJT APPROACH 

























These three bits, plus the data will be written into the computer 
memory. This cycle will occur every 31*25 msec. It is hoped that 
this approach will alleviate many of the present Decom problems, 
previously described, and in particular, the loss- of- sync problem. 

S OFTWARE AND 1824 


The Remote System software performs, remotely, closed- loop 
checkout of the Ground Support Equipment and certain Command 
Module functions. The Remote System will supplement the functions 
currently performed by the ACE-S/C stations and interfaces with 
the existing ACE-S/C stations. 

The Remote System software is composed of four functional 
areas: Executive, Control, Utility, and Test. These functional 

area programs are of necessity modular to allow for overlays in 
computer memory. 

The Executive program consists of routines to control all 
functions of the Remote System. These routines control the handling 
of interrupts, analization of messages and transfer of control to 
the Control, Utility, or Test programs. The Executive, in addition 
to controlling closed loop tests, communicates with the central 
computer for manual input requirements such as starting and terminat 
ing tests and switching to the bypass mode of operation. 

The Control programs consist of routines to control the 
stimulus eqi. hent and the measurement equipment. The control 
of the stimulus and measurement equipment will be determined from 
pre-determined test sequences, from special routines, and from 
special test sequences transmitted from the central computer. 

While in the fault mode Control routines are used to access 
measurements and perform limit checks. Control routines are 
used to access separate A/B PCM measurements and perform limit 
checks and other analysis on that data. During the normal mode 
of operation, measurements other than A/B PCM are transmitted to 
the remote computer only when an out-of-limits condition exists. 

Some Control programs are classified as safing routines. These 
safing routines are used when critical measurements are encountered. 

The Test programs consist of routines to simulate or create 
input data to the Executive, Control, and Utility programs for 
checking the program logic. Test programs also include routines 
to check out the stimulus and measurement equipment to insure that 
the equipment is operational. 
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The Utility programs consist of routines to perform con- 
versions of data to engineering units, to transmit data to and 
from the central computer, to load the sequencer memory and 
verify the load, and to control data transfers with the remote 
computer console. Utility routines are used to build software 
program tapes and to allow for tape (data and system) file 
maintenance. Utility programs include two assemblers, one to 
generate sequencer programs and one to generate remote computer 
programs . 
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REMOTE SYSTEM 
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ROUTINE 

SEQUENCER 
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GENERATION 

ROUTINE 

SOFTWARE 

TAPE 

PREPARATION 

ROUTINE 

FAULT MODE 
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ROUTINE 

TEST 
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EXECUTIVE 

SIMULATION 
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UTILITY 

SIMULATION 
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MEASUREMENT 

SIMULATION 
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CONTROL 

SIMULATION 
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GLOSSARY 


CSM/LM 

- 

Command Service Module/Lunar Module 

S/C 

- 

Spacecraft 

CDC 

- 

Control Data Corporation 

PCM 

- 

Pulse Code Modulation 

A/N 

- 

Alpha Numeric 

GSE 

- 

Ground Support Equipment 

C/O 

- 

Carry-on 

I/O 

- 

Input/Output 

CDT 

- 

Compressed Data Tape 

SPS 

- 

Samples per Second 

G/N 

- 

Guidance/Navigation 

C/O 

- 

Checkout 

OCP 

- 

Operational Checkout Procedure 


